TP-Link Kasa Protocol Flaw Enables Forged Smart-Device Commands

TP-Link disclosed CVE-2026-76784, a high-severity vulnerability (CVSS v4.0 8.7) in the local communications protocol used by multiple Kasa smart-home devices. Insufficient cryptographic protections allow an attacker on the same local or wireless network to intercept, replay, or forge device-control messages without authentication, privileges, or user interaction, potentially affecting smart plugs, switches, lights, and related products.

An attacker could change device states without authorization, disrupt connected appliances, or cause denial-of-service conditions. TP-Link has issued model-specific firmware updates through the Kasa application; users should install the update applicable to their exact hardware version and isolate IoT devices from guest and less-trusted networks until remediation is complete. No confirmed exploitation in the wild or public proof of concept has been reported.